A Cross-site Scripting (XSS) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.2. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.2.3.
CVE-2026-118545 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation. Fixed versions are 1.4.11 and 1.5.2.
CVE-2026-118546 is a Cross-site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions are 1.4.11 and 1.5.2.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts.
CVE-2026-118552 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions 1.4.11 and 1.5.2 address this issue.
A stored cross-site scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 up to 1.4.11 and from 1.5.0 up to 1.5.2. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
CVE-2026-118575 is a stored cross-site scripting (XSS) vulnerability in the Drupal Signature pad widget. It affects versions from 0.0.0 up to but not including 1.15.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 1.15.0.
A Cross-site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module. This flaw allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The vulnerability affects Stage File Proxy versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. Fixed versions are 3.1.7 and 4.0.1.
An authenticated cross-site scripting (XSS) vulnerability exists in Spina CMS version 2.21.0 in the /spina/embeddable.rb component. This flaw allows attackers with authentication to inject arbitrary web scripts or HTML via a crafted URL, potentially leading to script execution in the context of the affected application.
CVE-2026-115355 is a vulnerability in the Mistune Markdown parser's Include directive that allows path traversal and cross-site scripting (XSS). The directive does not properly validate file paths, enabling attackers to read arbitrary files via '../' sequences. Additionally, error messages and included file contents are rendered without HTML escaping, causing XSS even when escaping is enabled. This vulnerability affects Mistune versions from 1.8.0 up to but not including 1.10.1. The Include plugin must be explicitly enabled for the vulnerability to be exploitable. A fix is available in version 1.10.1.
The LiteLLM proxy's /sso/debug/callback endpoint is vulnerable to reflected cross-site scripting (XSS) due to improper handling of identity-provider-controlled fields in an inline script block. An attacker can inject a string containing </script> to break out of the script context and execute arbitrary JavaScript in the proxy's origin. This endpoint requires no authentication, allowing attackers with an account on the configured identity provider to craft malicious callback URLs that, when visited by a logged-in proxy admin, can lead to session cookie theft and full admin account takeover.
Zimbra Classic UI is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the From email header during HTML reply composition. An attacker can send a crafted email with a malicious From header containing JavaScript. When the victim opens the message and replies in HTML mode with reply headers disabled, the payload executes in the browser. This can lead to session theft or unauthorized actions. The issue is fixed in version 10.1.21.
Zimbra email software has a stored cross-site scripting (XSS) vulnerability via the Content-Location MIME header in email attachments. An attacker can craft an email with a malicious Content-Location header containing a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser. This vulnerability was fixed in Zimbra version 10.1.21.
CVE-2026-61995 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting YouTube Showcase versions up to and including 4.1.0. This flaw allows attackers to execute malicious scripts in the context of the affected application without requiring authentication.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Auction Nudge – Your eBay on Your Site versions up to 8.4.0. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.
Blockonomics version 3.11.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. This flaw allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. No affected versions beyond 3.11.0 or patch information are provided.
A Cross Site Scripting (XSS) vulnerability exists in Podamibe Custom User Gravatar versions up to and including 1.0.8. This vulnerability affects subscribers and allows for execution of malicious scripts in the context of the affected application.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Razorpay Payment Button Elementor Plugin versions up to and including 1.2.8. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Easy Property Listings versions up to and including 3.5.25. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application without requiring authentication.